The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Linux access decisions come from several layers: the file’s owner and group, its read/write/execute mode bits, any POSIX ACL, and controls such as mount options or security policy. Start by inspecting those layers, then change only the one that is wrong. chown changes ownership, chmod changes mode bits, and ACL tools add named-user or named-group exceptions.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
How Linux represents access
Every inode has a user owner, a group owner and permission information. The classic permission model has three classes: owner, group and other. Each class can have read, write and execute rights. For a regular file, read opens its contents, write changes them and execute allows it to run as a program. For a directory, the meanings are different: read lists names, write permits creating or removing directory entries, and execute permits traversal and lookup of entries inside the directory.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThat directory distinction explains many apparent contradictions. A user may be able to list a directory but not open a file in it, or may know a filename and open it while being unable to list the directory. Removing a file generally depends on write and execute permission on its parent directory, not on the file’s own write bit.
Read a permission string without guessing
Run ls -l path. A typical result begins with a ten-character type-and-mode field:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
-rwxr-x--- 1 deploy web 1842 Oct 15 12:00 app.sh- The first character identifies the file type:
-is a regular file anddis a directory. Other type characters represent objects such as symbolic links or device files. - Characters two through four are the owner’s read, write and execute bits.
- Characters five through seven are the group’s bits.
- Characters eight through ten are the other-users’ bits.
- The link count, owner, group, size and timestamps follow the mode field.
In the example, the owner can read, write and execute; members of the web group can read and execute; everyone else has no permission. The x on a directory should be read as search or traversal, not as permission to run the directory.
Use stat when you need unambiguous numeric and identity data:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutestat -c '%A %a %U %G %n' pathThis prints the symbolic mode, octal mode, user owner, group owner and name. Add ls -ld directory when you want the directory’s own mode rather than the contents it contains.
What chmod numbers mean
Octal mode values combine three independent bits: read is 4, write is 2 and execute is 1. Add the values for each class, in owner, group, other order.
| Bit | Value | Meaning for a regular file | Meaning for a directory |
|---|---|---|---|
| Read | 4 | Open and read contents | List names |
| Write | 2 | Modify contents | Create or remove entries |
| Execute | 1 | Run as a program | Traverse and search |
Therefore:
chmod 640 filegives the owner read/write (6), the group read (4), and other users nothing (0).chmod 750 directorygives the owner full access, the group read and traversal, and other users no access.chmod 600 secretmakes a regular file readable and writable only by its owner.
Octal notation is best when you are establishing a complete, known policy. It replaces the targeted classes’ existing bits, so record the intended result before applying it.
Use symbolic modes for narrow edits
Symbolic syntax changes one dimension while preserving unrelated bits. The class letters are u (owner), g (group), o (other) and a (all); operators are +, - and =.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
chmod g+rX directory
chmod o-rwx file
chmod u=rw,g=r,o= fileX adds execute/search only to directories and to files that already have an execute bit for some class, which is useful in trees containing both files and directories. Use = deliberately: it clears unspecified permissions for the classes named.
Ownership: chown, chgrp and chmod do different jobs
If the wrong account owns an object, changing mode bits is the wrong fix. Use:
chown user:group path
chown user path
chgrp group pathchown changes the user owner, the group owner, or both when written as user:group. chgrp changes only the group. chmod changes mode bits and does not transfer ownership. Check the result with ls -l or stat before moving on to permission analysis.
Apply ownership changes to the smallest path that solves the problem. Recursive forms such as chown -R user:group tree can alter an entire service hierarchy, including directories whose execute bit is needed for traversal. Review the path and sample the resulting objects before using a broad command. Treat recursive chmod -R with the same caution; one mode is rarely correct for every regular file, directory and executable in a tree.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special permission bits
A fourth, leading octal digit controls special bits. The values are 4 for set-user-ID, 2 for set-group-ID and 1 for the sticky bit.
| Mode example | Bit | Effect | Operational caution |
|---|---|---|---|
4755 |
setuid | An executable runs with the file owner’s effective identity. | A vulnerability in the program can become an owner-privilege escalation. |
2750 |
setgid | An executable uses the file group’s effective identity; on most directories, new entries inherit the directory’s group. | Confirm that every writer should share that group. |
1777 |
sticky | In a shared directory, users are restricted from deleting or renaming entries owned by another user. | Sticky does not make files private; the directory still needs appropriate read/write/search settings. |
On a directory used by a team, setgid is often paired with a group-writable mode such as 2770. Verify that intended users are members of the group and that the directory’s execute bit is present. Setuid and setgid executables deserve a separate review of their source, ownership and write paths before they are enabled.
umask and the permissions of new objects
umask removes permission bits during creation by system calls such as open and mkdir. A regular file is commonly requested with mode 0666, while a directory is commonly requested with 0777; the process umask removes bits from those requested modes.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
umask
umask 022With requested file mode 0666 and a 022 umask, a new regular file is created as 0644: the owner keeps read/write, the group keeps read, and other users keep read. The creating program can request a different mode, so the umask is a filter rather than a promise that every file will have one identical mode.
A parent directory can have a default ACL. When present, that ACL supplies inherited access entries for newly created children and can change the result you would predict from the umask alone. Check both the process umask and the parent directory’s default ACL when a newly created file has unexpected permissions.
POSIX ACLs for named users and groups
Classic mode bits describe only one owner, one owning group and everyone else. POSIX Access Control Lists add named-user and named-group entries and directory defaults, allowing a specific account to receive access without changing the owning group or granting that access to all other users.
Inspect an ACL
If ls -l ends its mode field with a plus sign, extended ACL data is present in ACL-aware environments. Run:
getfacl pathgetfacl displays the access ACL and, for directories, any default ACL. Look for entries such as user:alice:r-x, named groups, and a mask entry. The mask limits the effective permissions of named users, named groups and the owning-group entry. Tools often show an #effective: comment when an entry grants more than the mask allows.
Free tools Windows power users keep installed
One-click scans. No signup required.
Grant one user access
setfacl -m u:alice:rw file
setfacl -m u:alice:rwx directory
getfacl file directoryFor a directory, include execute/search if the user must open entries beneath it. To supply inherited rights to future children, set a default ACL on the directory:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
setfacl -d -m g:team:rwx directory
getfacl directoryChoose the narrowest named entry that solves the requirement, then verify the mask and test as the target account. An ACL entry can exist yet be ineffective because the mask is too restrictive.
Classic modes versus ACLs
| Decision axis | Classic owner/group/other modes | POSIX ACLs |
|---|---|---|
| Principals expressible | One owner, one group and other users. | Named users and groups in addition to the owning entries. |
| Auditing | Compact and visible in ordinary ls -l output. |
Requires getfacl; a plus sign signals that mode bits are not the whole policy. |
| Inheritance | Directory setgid can preserve group ownership; mode bits alone do not express per-user defaults. | Directory default ACLs can provide inherited named-user and named-group rights. |
| Portability | Broadly understood across Unix-like systems and filesystems. | Support and behavior depend on the filesystem and Unix implementation. |
| Common risk | Granting too much through a broad group or other-users entry. | The ACL mask silently limits effective rights, or an overlooked ACL defeats assumptions based only on ls -l. |
Use classic modes when owner/group/other express the policy cleanly. Use ACLs when named principals or inherited exceptions are genuinely required, and document them so future administrators know to inspect beyond the mode string.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A repeatable permission-change workflow
- Inspect first. Run
ls -l path,stat -c '%A %a %U %G %n' path, andgetfacl pathwhen a plus sign appears. For a directory, inspect both the directory itself and the target child. - Check the complete path. A process needs search permission on every parent directory. Examine each component with
namei -l /path/to/objector individualls -ldcommands. - Separate identity from access. If owner or group is wrong, use a narrowly scoped
chownorchgrp. If identities are correct, adjust mode bits or ACLs instead. - Choose the smallest change. Use symbolic
chmodfor one class or bit; use an explicit octal mode when replacing the complete policy. Avoid adding write access merely to make a test pass. - Account for creation rules. Check the service account’s
umask, parent default ACLs and any setgid directory used for shared output. - Recheck and test as the real identity. Inspect the resulting mode and ACL, then reproduce the operation as the service user or an equivalent account. A test as root does not prove that an unprivileged service can access the path.
Diagnose a service that cannot read or write
Follow this order so that a later layer does not distract you from a simpler failure:
- Path traversal: verify search permission on every parent directory, including directories above the file that the service rarely visits directly.
- Owner and group: confirm the process account and its supplementary groups. A correct group on disk is useless if the service was started without membership in that group.
- Mode bits: determine which class the process actually matches and whether the needed read, write or execute/search bit is present.
- ACL and mask: run
getfacl; check named entries, default entries and the effective rights shown beside the mask. - Special attributes: inspect attributes with
lsattrwhen a file appears writable but refuses changes. An immutable attribute can block modifications even when mode bits allow them. - Filesystem and policy: check whether the filesystem is mounted read-only and whether a mandatory security policy such as SELinux or AppArmor is denying the operation. Mode bits and ACLs do not override those controls.
For a read failure, do not grant write as a diagnostic shortcut. For a write failure, identify whether the application is creating a new entry, replacing an existing file, or changing metadata; each operation can require permissions on the parent directory as well as the file.
Common mistakes and safer replacements
Using 777 as a universal fix
chmod 777 grants read, write and execute/search to owner, group and other users. It may hide the original ownership, traversal or ACL problem while allowing any local account or compromised process to modify data. Identify the required writer, assign an appropriate group or named ACL entry, and grant only the required bits.
Confusing file execute with directory search
Adding execute to a regular data file does not make a service able to find it. Conversely, removing execute from a parent directory can block access to a perfectly readable child. Evaluate file permissions and each directory’s search permission separately.
Changing mode when ownership is wrong
If a deployment created files as the wrong account, repeatedly widening modes creates a lasting exposure. Correct the service account, group ownership or creation environment, then reset modes to the intended policy.
Recommended Free Tools
Forgetting that ACLs survive a mode-only review
A plus sign in ls -l is a prompt to inspect with getfacl. Conversely, removing an ACL or changing its mask can reduce a named user’s effective rights even though the nine familiar mode characters look unchanged.
Practical patterns for server administrators
Private configuration file
Make the service owner the owner, assign the administrative group if needed, and use a mode such as 640 when group readers are required. Use 600 when no group member should read it. Verify that parent directories permit traversal but do not expose directory listings unnecessarily.
Shared deployment directory
Create a dedicated group, add the intended accounts, make the directory group-owned, and use a group-writable setgid mode such as 2770 where appropriate. The setgid bit keeps new entries in the shared group; a suitable umask or default ACL then determines whether those entries are group-readable or group-writable.
One operator needs an exception
Keep the existing owner and group policy, add a named ACL entry for that operator, inspect the mask with getfacl, and test the exact operation. Remove the entry when the temporary requirement ends.
Quick Recap
Reference commands
| Goal | Command |
|---|---|
| Inspect mode, owner and group | ls -l path |
| Inspect numeric mode and identities | stat -c '%A %a %U %G %n' path |
| Change owner and group | chown user:group path |
| Change only the group | chgrp group path |
| Set a complete mode | chmod 640 file |
| Make a targeted mode edit | chmod g+rX directory |
| Inspect ACLs | getfacl path |
| Add a named-user ACL | setfacl -m u:alice:rw file |
| Set inherited default ACL rights | setfacl -d -m g:team:rwx directory |
| Display the current umask | umask |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
